CVE-2026-53193

Analyzed Analyzed - Analysis Complete

Linux Kernel Timer Use-After-Free Vulnerability

Publication date: 2026-06-25

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tries to unlink all instances and just set NULL to each ti->timer, then releases the resources immediately. The problem is, however, when there are slave timer instances that are associated with a master instance linked to this timer: namely, those slave instances still point to the freed timer object although the master instance is unlinked, which may lead to user-after-free. The bug can be easily triggered particularly when a new userspace-driven timers (CONFIG_SND_UTIMER) is involved, since it can create and delete the timer object via a simple file open/close, while the other applications may keep accessing to that timer. This patch is an attempt to paper over the problem above: now instead of just unlinking, call snd_timer_close[_locked]() forcibly for each pending timer instance, so that all assigned slave timer instances are properly detached, too. Since snd_timer_close() might be called later by the driver that created that instance, the check of SNDRV_TIMER_IFLG_DEAD is added at the beginning, too.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-06

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53193

EUVD

EUVD-2026-39284

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.12 (inc) to 6.12.94 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's ALSA timer subsystem. When a snd_timer object is freed while there are still pending snd_timer_instance objects linked to it, the system attempts to unlink these instances and set their timer pointers to NULL. However, if there are slave timer instances associated with a master instance linked to this timer, those slave instances may still point to the freed timer object, leading to a user-after-free condition.

This bug can be triggered especially when userspace-driven timers (CONFIG_SND_UTIMER) are involved, as these timers can be created and deleted simply by opening and closing files, while other applications might continue accessing the timer.

The fix involves forcibly closing each pending timer instance to ensure all slave timer instances are properly detached, preventing them from referencing freed memory.

Impact Analysis

This vulnerability can lead to a user-after-free condition in the Linux kernel's ALSA timer subsystem. Such a condition may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the use of freed memory.

Since the issue involves timers that can be manipulated from userspace, it may be triggered by applications interacting with the sound system, potentially impacting system reliability and security.

Mitigation Strategies

The vulnerability is resolved by a patch in the Linux kernel that forcibly closes timer instances when they are freed, preventing user-after-free conditions related to ALSA timer objects.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this patch.

Hi! I’m here to help you understand CVE-2026-53193. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70